components/view/access-form/index.tsx (1)

56-59: Tighten the prop type to a string union.

Avoids accidental typos and aligns with backend constraint.

-  agreementContentType?: string;
+  agreementContentType?: "LINK" | "TEXT";

components/links/link-sheet/agreement-panel/index.tsx (6)

63-69: Type the local state and narrow contentType.

Avoid implicit any and lock contentType to the union.

-  const [data, setData] = useState({ 
+  const [data, setData] = useState<{
+    name: string;
+    link: string;
+    textContent: string;
+    contentType: "LINK" | "TEXT";
+    requireName: boolean;
+  }>({
     name: "", 
     link: "", 
     textContent: "",
     contentType: "LINK",
     requireName: true 
   });

---

91-99: Reset validation state on close.

Clear URL validation state to avoid stale UI when reopening.

   const handleClose = (open: boolean) => {
     setIsOpen(open);
     setData({ 
       name: "", 
       link: "", 
       textContent: "",
       contentType: "LINK",
       requireName: true 
     });
+    setUrlError("");
+    setIsUrlValid(true);
     setCurrentFile(null);
     setIsLoading(false);
     if (onClose) {
       onClose();
     }
   };

---

226-231: Consider aligning submit DTO with a shared type.

If a shared AgreementCreateRequest exists, import it to prevent drift.

Would you like a quick shared type stub I can add under types/api.ts?

---

251-260: Deduplicate close/reset logic; call handleClose(false).

Keeps behavior consistent and ensures onClose runs.

-      setIsLoading(false);
-      setIsOpen(false);
-      setData({ 
-        name: "", 
-        link: "", 
-        textContent: "",
-        contentType: "LINK",
-        requireName: true 
-      });
+      setIsLoading(false);
+      handleClose(false);

---

378-379: Clarify accepted upload types to match validation.

UI currently suggests many types, but handler allows only PDF/Word.

-                          <Label>Or upload an agreement</Label>
+                          <Label>Or upload an agreement (PDF or Word)</Label>

---

430-433: Optional: disable submit on empty LINK.

Relying solely on required works, but pre-emptive disable improves UX.

   disabled={
-      (data.contentType === "LINK" && !isUrlValid && data.link.trim() !== "") ||
+      (data.contentType === "LINK" && (!data.link.trim() || !isUrlValid)) ||
       (data.contentType === "TEXT" && !data.textContent.trim())
     }

prisma/schema/document.prisma (3)

69-70: Fix truncated comment.

-  pageNumber    Int // e.g., 1, 2, 3 for 
+  pageNumber    Int // e.g., 1, 2, 3 for page numbering

---

72-72: Correct typo in comment (originalHeight).

-  metadata      Json? // This will store the page metadata: {originalWidth: 100, origianlHeight: 100, scaledWidth: 50, scaledHeight: 50, scaleFactor: 2}
+  metadata      Json? // This will store the page metadata: {originalWidth: 100, originalHeight: 100, scaledWidth: 50, scaledHeight: 50, scaleFactor: 2}

---

31-34: Name pluralization (optional).

uploadedDocument is an array; consider uploadedDocuments for clarity (breaking change).

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

pages/api/teams/[teamId]/agreements/index.ts (2)

14-23: Harden schema: trim, enforce http/https for LINK, and cap TEXT length.

As-is, " " passes min(1) then becomes empty after .trim(). Also, LINK allows javascript: (XSS vector) and very long TEXT is unbounded.

Apply this diff to the schema:

-const createAgreementSchema = z.object({
-  name: z
-    .string()
-    .min(1, "Name is required")
-    .max(150, "Name must be less than 150 characters"),
-  content: z.string().min(1, "Content is required"),
-  contentType: z.enum(["LINK", "TEXT"]).default("LINK"),
-  requireName: z.boolean().default(false),
-});
+const createAgreementSchema = z
+  .object({
+    name: z
+      .string()
+      .trim()
+      .min(1, "Name is required")
+      .max(150, "Name must be less than 150 characters"),
+    content: z.string().trim().min(1, "Content is required"),
+    contentType: z.enum(["LINK", "TEXT"]).default("LINK"),
+    requireName: z.boolean().default(false),
+  })
+  .superRefine((val, ctx) => {
+    if (val.contentType === "LINK") {
+      try {
+        const url = new URL(val.content);
+        if (url.protocol !== "http:" && url.protocol !== "https:") {
+          ctx.addIssue({
+            code: z.ZodIssueCode.custom,
+            path: ["content"],
+            message: "Only http/https URLs are allowed for LINK contentType.",
+          });
+        }
+      } catch {
+        ctx.addIssue({
+          code: z.ZodIssueCode.custom,
+          path: ["content"],
+          message: "Invalid URL for LINK contentType.",
+        });
+      }
+    } else {
+      // TEXT
+      if (val.content.length > 5000) {
+        ctx.addIssue({
+          code: z.ZodIssueCode.too_big,
+          maximum: 5000,
+          type: "string",
+          inclusive: true,
+          path: ["content"],
+          message: "Text content exceeds 5000 characters.",
+        });
+      }
+    }
+  });

---

113-115: Sanitize TEXT; normalize LINK.

Sanitizing a URL string doesn’t prevent javascript: or data: schemes. Use sanitization only for TEXT and persist a normalized URL for LINK.

Apply this diff:

-      // Sanitize content using existing sanitization logic
-      const sanitizedContent = validateContent(content);
+      // Sanitize/normalize by contentType
+      const sanitizedContent =
+        contentType === "TEXT"
+          ? validateContent(content)
+          : new URL(content).toString();

pages/api/teams/[teamId]/agreements/index.ts (2)

111-112: Minor: Schema default makes fallback unnecessary downstream.

Since defaults are applied by Zod, all fields are present and normalized here.

---

119-122: Drop redundant default and rely on validated/normalized values.

Zod already defaulted contentType to "LINK"; also avoid storing post-trim empty names.

Apply this diff:

-          name: name.trim(),
-          content: sanitizedContent,
-          contentType: contentType || "LINK",
+          name,
+          content: sanitizedContent,
+          contentType,

If you prefer always-trimmed name/content at the DB edge, keep .trim() but pair it with the schema .trim() to ensure min(1) still holds after trimming.

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro